zend-escaper
zend-escaper copied to clipboard
Documentation for the "Good" URL escaping is still not good
- [x] I was not able to find an open or closed issue matching what I'm seeing.
- [x] This is not a question. (Questions should be asked on chat (Signup here) or our forums.)
The example used on https://docs.zendframework.com/zend-escaper/escaping-url/ is not only building a URL. It is also outputting this URL in an HTML context. So this is a case of nested contexts:
- the name must be escaped as URL component (good)
- the whole URL must be escaped as HTML attribute value (not good currently)
This is kind of unfortunate to show this as a good usage of escaping when a previous chapter was precisely warning about nested contexts.
The example should either be improved to apply the necessary HTML escaping, or be replaced by another example using the URL in a non-HTML context.
This repository has been closed and moved to laminas/laminas-escaper; a new issue has been opened at https://github.com/laminas/laminas-escaper/issues/1.